Error with real time monitoring enabled. Log file on Windows Agent:
2011/01/24 16:10:28 ossec-agent(1226): ERROR: Error reading XML file 'ossec.conf': XMLERR: Attribute 'realtime' not followed by a " or '. (line 107). 2011/01/24 16:10:28 ossec-agent: Received exit signal. I did not see any errors in the ossec.log file on the server, is this where I should look. Thanks, -Mike On Mon, Jan 24, 2011 at 3:19 PM, dan (ddp) <[email protected]> wrote: > Hi Mike, > > On Mon, Jan 24, 2011 at 5:12 PM, Mike Smith <[email protected]> wrote: > > Hello, > > > > I have my agent working again. Now the reason for the whole upgrade to > get > > real time monitoring working. > > > > Is this the right way to do it for a windows agent > > > > <syscheck> > > <directories realtime="yes" check_all="yes">c:\inetpub/</directories> > > <directories check_all="yes">c:\inetpub/</directories> > > </syscheck> > > > > or this way > > > > <syscheck> > > <directories realtime="yes" check_all="yes">c:\inetpub/</directories> > > </syscheck> > > > > Thanks, > > > > > > > > Mike > > > > > > There's no need to duplicated things. The second entry should work > just fine. Notice the check_all option is enabled in that entry, so > there is no need to make another entry just to enable check_all. >
